You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Fix various certificate fingerprint issues. By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 (Imported from upstream's 85cfc188c06bd046420ae70dd6e302f9efe022a9 and 4c52816d35681c0533c25fdd3abb4b7c6962302d) Change-Id: Ic901aea8ea6457df27dc542a11c30464561e322b Reviewed-on: https://boringssl-review.googlesource.com/2783 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
пре 9 година
Switch OPENSSL_VERSION_NUMBER to 1.1.0. Although we are derived from 1.0.2, we mimic 1.1.0 in some ways around our FOO_up_ref functions and opaque libssl types. This causes some difficulties when porting third-party code as any OPENSSL_VERSION_NUMBER checks for 1.1.0 APIs we have will be wrong. Moreover, adding accessors without changing OPENSSL_VERSION_NUMBER can break external projects. It is common to implement a compatibility version of an accessor under #ifdef as a static function. This then conflicts with our headers if we, unlike OpenSSL 1.0.2, have this function. This change switches OPENSSL_VERSION_NUMBER to 1.1.0 and atomically adds enough accessors for software with 1.1.0 support already. The hope is this will unblock hiding SSL_CTX and SSL_SESSION, which will be especially useful with C++-ficiation. The cost is we will hit some growing pains as more 1.1.0 consumers enter the ecosystem and we converge on the right set of APIs to import from upstream. It does not remove any 1.0.2 APIs, so we will not require that all projects support 1.1.0. The exception is APIs which changed in 1.1.0 but did not change the function signature. Those are breaking changes. Specifically: - SSL_CTX_sess_set_get_cb is now const-correct. - X509_get0_signature is now const-correct. For C++ consumers only, this change temporarily includes an overload hack for SSL_CTX_sess_set_get_cb that keeps the old callback working. This is a workaround for Node not yet supporting OpenSSL 1.1.0. The version number is set at (the as yet unreleased) 1.1.0g to denote that this change includes https://github.com/openssl/openssl/pull/4384. Bug: 91 Change-Id: I5eeb27448a6db4c25c244afac37f9604d9608a76 Reviewed-on: https://boringssl-review.googlesource.com/10340 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
пре 8 година
Align with upstream's error strings, take two. I messed up a few of these. ASN1_R_UNSUPPORTED_ALGORITHM doesn't exist. X509_R_UNSUPPORTED_ALGORITHM does exist as part of X509_PUBKEY_set, but the SPKI parser doesn't emit this. (I don't mind the legacy code having really weird errors, but since EVP is now limited to things we like, let's try to keep that clean.) To avoid churn in Conscrypt, we'll keep defining X509_R_UNSUPPORTED_ALGORITHM, but not actually do anything with it anymore. Conscrypt was already aware of EVP_R_UNSUPPORTED_ALGORITHM, so this should be fine. (I don't expect EVP_R_UNSUPPORTED_ALGORITHM to go away. The SPKI parsers we like live in EVP now.) A few other ASN1_R_* values didn't quite match upstream, so make those match again. Finally, I got some of the rsa_pss.c values wrong. Each of those corresponds to an (overly specific) RSA_R_* value in upstream. However, those were gone in BoringSSL since even the initial commit. We placed the RSA <-> EVP glue in crypto/evp (so crypto/rsa wouldn't depend on crypto/evp) while upstream placed them in crypto/rsa. Since no one seemed to notice the loss of RSA_R_INVALID_SALT_LENGTH, let's undo all the cross-module errors inserted in crypto/rsa. Instead, since that kind of specificity is not useful, funnel it all into X509_R_INVALID_PSS_PARAMETERS (formerly EVP_R_INVALID_PSS_PARAMETERS, formerly RSA_R_INVALID_PSS_PARAMETERS). Reset the error codes for all affected modules. (That our error code story means error codes are not stable across this kind of refactoring is kind of a problem. Hopefully this will be the last of it.) Change-Id: Ibfb3a0ac340bfc777bc7de6980ef3ddf0a8c84bc Reviewed-on: https://boringssl-review.googlesource.com/7458 Reviewed-by: Emily Stark (Dunn) <estark@google.com> Reviewed-by: David Benjamin <davidben@google.com>
пре 8 година
Align with upstream's error strings, take two. I messed up a few of these. ASN1_R_UNSUPPORTED_ALGORITHM doesn't exist. X509_R_UNSUPPORTED_ALGORITHM does exist as part of X509_PUBKEY_set, but the SPKI parser doesn't emit this. (I don't mind the legacy code having really weird errors, but since EVP is now limited to things we like, let's try to keep that clean.) To avoid churn in Conscrypt, we'll keep defining X509_R_UNSUPPORTED_ALGORITHM, but not actually do anything with it anymore. Conscrypt was already aware of EVP_R_UNSUPPORTED_ALGORITHM, so this should be fine. (I don't expect EVP_R_UNSUPPORTED_ALGORITHM to go away. The SPKI parsers we like live in EVP now.) A few other ASN1_R_* values didn't quite match upstream, so make those match again. Finally, I got some of the rsa_pss.c values wrong. Each of those corresponds to an (overly specific) RSA_R_* value in upstream. However, those were gone in BoringSSL since even the initial commit. We placed the RSA <-> EVP glue in crypto/evp (so crypto/rsa wouldn't depend on crypto/evp) while upstream placed them in crypto/rsa. Since no one seemed to notice the loss of RSA_R_INVALID_SALT_LENGTH, let's undo all the cross-module errors inserted in crypto/rsa. Instead, since that kind of specificity is not useful, funnel it all into X509_R_INVALID_PSS_PARAMETERS (formerly EVP_R_INVALID_PSS_PARAMETERS, formerly RSA_R_INVALID_PSS_PARAMETERS). Reset the error codes for all affected modules. (That our error code story means error codes are not stable across this kind of refactoring is kind of a problem. Hopefully this will be the last of it.) Change-Id: Ibfb3a0ac340bfc777bc7de6980ef3ddf0a8c84bc Reviewed-on: https://boringssl-review.googlesource.com/7458 Reviewed-by: Emily Stark (Dunn) <estark@google.com> Reviewed-by: David Benjamin <davidben@google.com>
пре 8 година
Align with upstream's error strings, take two. I messed up a few of these. ASN1_R_UNSUPPORTED_ALGORITHM doesn't exist. X509_R_UNSUPPORTED_ALGORITHM does exist as part of X509_PUBKEY_set, but the SPKI parser doesn't emit this. (I don't mind the legacy code having really weird errors, but since EVP is now limited to things we like, let's try to keep that clean.) To avoid churn in Conscrypt, we'll keep defining X509_R_UNSUPPORTED_ALGORITHM, but not actually do anything with it anymore. Conscrypt was already aware of EVP_R_UNSUPPORTED_ALGORITHM, so this should be fine. (I don't expect EVP_R_UNSUPPORTED_ALGORITHM to go away. The SPKI parsers we like live in EVP now.) A few other ASN1_R_* values didn't quite match upstream, so make those match again. Finally, I got some of the rsa_pss.c values wrong. Each of those corresponds to an (overly specific) RSA_R_* value in upstream. However, those were gone in BoringSSL since even the initial commit. We placed the RSA <-> EVP glue in crypto/evp (so crypto/rsa wouldn't depend on crypto/evp) while upstream placed them in crypto/rsa. Since no one seemed to notice the loss of RSA_R_INVALID_SALT_LENGTH, let's undo all the cross-module errors inserted in crypto/rsa. Instead, since that kind of specificity is not useful, funnel it all into X509_R_INVALID_PSS_PARAMETERS (formerly EVP_R_INVALID_PSS_PARAMETERS, formerly RSA_R_INVALID_PSS_PARAMETERS). Reset the error codes for all affected modules. (That our error code story means error codes are not stable across this kind of refactoring is kind of a problem. Hopefully this will be the last of it.) Change-Id: Ibfb3a0ac340bfc777bc7de6980ef3ddf0a8c84bc Reviewed-on: https://boringssl-review.googlesource.com/7458 Reviewed-by: Emily Stark (Dunn) <estark@google.com> Reviewed-by: David Benjamin <davidben@google.com>
пре 8 година
Align with upstream's error strings, take two. I messed up a few of these. ASN1_R_UNSUPPORTED_ALGORITHM doesn't exist. X509_R_UNSUPPORTED_ALGORITHM does exist as part of X509_PUBKEY_set, but the SPKI parser doesn't emit this. (I don't mind the legacy code having really weird errors, but since EVP is now limited to things we like, let's try to keep that clean.) To avoid churn in Conscrypt, we'll keep defining X509_R_UNSUPPORTED_ALGORITHM, but not actually do anything with it anymore. Conscrypt was already aware of EVP_R_UNSUPPORTED_ALGORITHM, so this should be fine. (I don't expect EVP_R_UNSUPPORTED_ALGORITHM to go away. The SPKI parsers we like live in EVP now.) A few other ASN1_R_* values didn't quite match upstream, so make those match again. Finally, I got some of the rsa_pss.c values wrong. Each of those corresponds to an (overly specific) RSA_R_* value in upstream. However, those were gone in BoringSSL since even the initial commit. We placed the RSA <-> EVP glue in crypto/evp (so crypto/rsa wouldn't depend on crypto/evp) while upstream placed them in crypto/rsa. Since no one seemed to notice the loss of RSA_R_INVALID_SALT_LENGTH, let's undo all the cross-module errors inserted in crypto/rsa. Instead, since that kind of specificity is not useful, funnel it all into X509_R_INVALID_PSS_PARAMETERS (formerly EVP_R_INVALID_PSS_PARAMETERS, formerly RSA_R_INVALID_PSS_PARAMETERS). Reset the error codes for all affected modules. (That our error code story means error codes are not stable across this kind of refactoring is kind of a problem. Hopefully this will be the last of it.) Change-Id: Ibfb3a0ac340bfc777bc7de6980ef3ddf0a8c84bc Reviewed-on: https://boringssl-review.googlesource.com/7458 Reviewed-by: Emily Stark (Dunn) <estark@google.com> Reviewed-by: David Benjamin <davidben@google.com>
пре 8 година
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912
  1. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  2. * All rights reserved.
  3. *
  4. * This package is an SSL implementation written
  5. * by Eric Young (eay@cryptsoft.com).
  6. * The implementation was written so as to conform with Netscapes SSL.
  7. *
  8. * This library is free for commercial and non-commercial use as long as
  9. * the following conditions are aheared to. The following conditions
  10. * apply to all code found in this distribution, be it the RC4, RSA,
  11. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  12. * included with this distribution is covered by the same copyright terms
  13. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  14. *
  15. * Copyright remains Eric Young's, and as such any Copyright notices in
  16. * the code are not to be removed.
  17. * If this package is used in a product, Eric Young should be given attribution
  18. * as the author of the parts of the library used.
  19. * This can be in the form of a textual message at program startup or
  20. * in documentation (online or textual) provided with the package.
  21. *
  22. * Redistribution and use in source and binary forms, with or without
  23. * modification, are permitted provided that the following conditions
  24. * are met:
  25. * 1. Redistributions of source code must retain the copyright
  26. * notice, this list of conditions and the following disclaimer.
  27. * 2. Redistributions in binary form must reproduce the above copyright
  28. * notice, this list of conditions and the following disclaimer in the
  29. * documentation and/or other materials provided with the distribution.
  30. * 3. All advertising materials mentioning features or use of this software
  31. * must display the following acknowledgement:
  32. * "This product includes cryptographic software written by
  33. * Eric Young (eay@cryptsoft.com)"
  34. * The word 'cryptographic' can be left out if the rouines from the library
  35. * being used are not cryptographic related :-).
  36. * 4. If you include any Windows specific code (or a derivative thereof) from
  37. * the apps directory (application code) you must include an acknowledgement:
  38. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  39. *
  40. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  41. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  42. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  43. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  44. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  45. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  46. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  48. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  49. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  50. * SUCH DAMAGE.
  51. *
  52. * The licence and distribution terms for any publically available version or
  53. * derivative of this code cannot be changed. i.e. this code cannot simply be
  54. * copied and put under another distribution licence
  55. * [including the GNU Public Licence.]
  56. */
  57. #ifndef HEADER_ASN1_H
  58. #define HEADER_ASN1_H
  59. #include <openssl/base.h>
  60. #include <time.h>
  61. #include <openssl/bio.h>
  62. #include <openssl/stack.h>
  63. #include <openssl/bn.h>
  64. #ifdef __cplusplus
  65. extern "C" {
  66. #endif
  67. /* Legacy ASN.1 library.
  68. *
  69. * This header is part of OpenSSL's ASN.1 implementation. It is retained for
  70. * compatibility but otherwise underdocumented and not actively maintained. Use
  71. * the new |CBS| and |CBB| library in <openssl/bytestring.h> instead. */
  72. #define V_ASN1_UNIVERSAL 0x00
  73. #define V_ASN1_APPLICATION 0x40
  74. #define V_ASN1_CONTEXT_SPECIFIC 0x80
  75. #define V_ASN1_PRIVATE 0xc0
  76. #define V_ASN1_CONSTRUCTED 0x20
  77. #define V_ASN1_PRIMITIVE_TAG 0x1f
  78. #define V_ASN1_APP_CHOOSE -2 /* let the recipient choose */
  79. #define V_ASN1_OTHER -3 /* used in ASN1_TYPE */
  80. #define V_ASN1_ANY -4 /* used in ASN1 template code */
  81. #define V_ASN1_NEG 0x100 /* negative flag */
  82. /* No supported universal tags may exceed this value, to avoid ambiguity with
  83. * V_ASN1_NEG. */
  84. #define V_ASN1_MAX_UNIVERSAL 0xff
  85. #define V_ASN1_UNDEF -1
  86. #define V_ASN1_EOC 0
  87. #define V_ASN1_BOOLEAN 1 /**/
  88. #define V_ASN1_INTEGER 2
  89. #define V_ASN1_NEG_INTEGER (2 | V_ASN1_NEG)
  90. #define V_ASN1_BIT_STRING 3
  91. #define V_ASN1_OCTET_STRING 4
  92. #define V_ASN1_NULL 5
  93. #define V_ASN1_OBJECT 6
  94. #define V_ASN1_OBJECT_DESCRIPTOR 7
  95. #define V_ASN1_EXTERNAL 8
  96. #define V_ASN1_REAL 9
  97. #define V_ASN1_ENUMERATED 10
  98. #define V_ASN1_NEG_ENUMERATED (10 | V_ASN1_NEG)
  99. #define V_ASN1_UTF8STRING 12
  100. #define V_ASN1_SEQUENCE 16
  101. #define V_ASN1_SET 17
  102. #define V_ASN1_NUMERICSTRING 18 /**/
  103. #define V_ASN1_PRINTABLESTRING 19
  104. #define V_ASN1_T61STRING 20
  105. #define V_ASN1_TELETEXSTRING 20 /* alias */
  106. #define V_ASN1_VIDEOTEXSTRING 21 /**/
  107. #define V_ASN1_IA5STRING 22
  108. #define V_ASN1_UTCTIME 23
  109. #define V_ASN1_GENERALIZEDTIME 24 /**/
  110. #define V_ASN1_GRAPHICSTRING 25 /**/
  111. #define V_ASN1_ISO64STRING 26 /**/
  112. #define V_ASN1_VISIBLESTRING 26 /* alias */
  113. #define V_ASN1_GENERALSTRING 27 /**/
  114. #define V_ASN1_UNIVERSALSTRING 28 /**/
  115. #define V_ASN1_BMPSTRING 30
  116. /* For use with d2i_ASN1_type_bytes() */
  117. #define B_ASN1_NUMERICSTRING 0x0001
  118. #define B_ASN1_PRINTABLESTRING 0x0002
  119. #define B_ASN1_T61STRING 0x0004
  120. #define B_ASN1_TELETEXSTRING 0x0004
  121. #define B_ASN1_VIDEOTEXSTRING 0x0008
  122. #define B_ASN1_IA5STRING 0x0010
  123. #define B_ASN1_GRAPHICSTRING 0x0020
  124. #define B_ASN1_ISO64STRING 0x0040
  125. #define B_ASN1_VISIBLESTRING 0x0040
  126. #define B_ASN1_GENERALSTRING 0x0080
  127. #define B_ASN1_UNIVERSALSTRING 0x0100
  128. #define B_ASN1_OCTET_STRING 0x0200
  129. #define B_ASN1_BIT_STRING 0x0400
  130. #define B_ASN1_BMPSTRING 0x0800
  131. #define B_ASN1_UNKNOWN 0x1000
  132. #define B_ASN1_UTF8STRING 0x2000
  133. #define B_ASN1_UTCTIME 0x4000
  134. #define B_ASN1_GENERALIZEDTIME 0x8000
  135. #define B_ASN1_SEQUENCE 0x10000
  136. /* For use with ASN1_mbstring_copy() */
  137. #define MBSTRING_FLAG 0x1000
  138. #define MBSTRING_UTF8 (MBSTRING_FLAG)
  139. /* |MBSTRING_ASC| refers to Latin-1, not ASCII. It is used with TeletexString
  140. * which, in turn, is treated as Latin-1 rather than T.61 by OpenSSL and most
  141. * other software. */
  142. #define MBSTRING_ASC (MBSTRING_FLAG|1)
  143. #define MBSTRING_BMP (MBSTRING_FLAG|2)
  144. #define MBSTRING_UNIV (MBSTRING_FLAG|4)
  145. #define DECLARE_ASN1_SET_OF(type) /* filled in by mkstack.pl */
  146. #define IMPLEMENT_ASN1_SET_OF(type) /* nothing, no longer needed */
  147. /* These are used internally in the ASN1_OBJECT to keep track of
  148. * whether the names and data need to be free()ed */
  149. #define ASN1_OBJECT_FLAG_DYNAMIC 0x01 /* internal use */
  150. #define ASN1_OBJECT_FLAG_DYNAMIC_STRINGS 0x04 /* internal use */
  151. #define ASN1_OBJECT_FLAG_DYNAMIC_DATA 0x08 /* internal use */
  152. struct asn1_object_st
  153. {
  154. const char *sn,*ln;
  155. int nid;
  156. int length;
  157. const unsigned char *data; /* data remains const after init */
  158. int flags; /* Should we free this one */
  159. };
  160. DEFINE_STACK_OF(ASN1_OBJECT)
  161. #define ASN1_STRING_FLAG_BITS_LEFT 0x08 /* Set if 0x07 has bits left value */
  162. /* This indicates that the ASN1_STRING is not a real value but just a place
  163. * holder for the location where indefinite length constructed data should
  164. * be inserted in the memory buffer
  165. */
  166. #define ASN1_STRING_FLAG_NDEF 0x010
  167. /* This flag is used by ASN1 code to indicate an ASN1_STRING is an MSTRING
  168. * type.
  169. */
  170. #define ASN1_STRING_FLAG_MSTRING 0x040
  171. /* This is the base type that holds just about everything :-) */
  172. struct asn1_string_st
  173. {
  174. int length;
  175. int type;
  176. unsigned char *data;
  177. /* The value of the following field depends on the type being
  178. * held. It is mostly being used for BIT_STRING so if the
  179. * input data has a non-zero 'unused bits' value, it will be
  180. * handled correctly */
  181. long flags;
  182. };
  183. /* ASN1_ENCODING structure: this is used to save the received
  184. * encoding of an ASN1 type. This is useful to get round
  185. * problems with invalid encodings which can break signatures.
  186. */
  187. typedef struct ASN1_ENCODING_st
  188. {
  189. unsigned char *enc; /* DER encoding */
  190. long len; /* Length of encoding */
  191. int modified; /* set to 1 if 'enc' is invalid */
  192. /* alias_only is zero if |enc| owns the buffer that it points to
  193. * (although |enc| may still be NULL). If one, |enc| points into a
  194. * buffer that is owned elsewhere. */
  195. unsigned alias_only:1;
  196. /* alias_only_on_next_parse is one iff the next parsing operation
  197. * should avoid taking a copy of the input and rather set
  198. * |alias_only|. */
  199. unsigned alias_only_on_next_parse:1;
  200. } ASN1_ENCODING;
  201. #define STABLE_FLAGS_MALLOC 0x01
  202. #define STABLE_NO_MASK 0x02
  203. #define DIRSTRING_TYPE \
  204. (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_BMPSTRING|B_ASN1_UTF8STRING)
  205. #define PKCS9STRING_TYPE (DIRSTRING_TYPE|B_ASN1_IA5STRING)
  206. typedef struct asn1_string_table_st {
  207. int nid;
  208. long minsize;
  209. long maxsize;
  210. unsigned long mask;
  211. unsigned long flags;
  212. } ASN1_STRING_TABLE;
  213. /* size limits: this stuff is taken straight from RFC2459 */
  214. #define ub_name 32768
  215. #define ub_common_name 64
  216. #define ub_locality_name 128
  217. #define ub_state_name 128
  218. #define ub_organization_name 64
  219. #define ub_organization_unit_name 64
  220. #define ub_title 64
  221. #define ub_email_address 128
  222. /* Declarations for template structures: for full definitions
  223. * see asn1t.h
  224. */
  225. typedef struct ASN1_TEMPLATE_st ASN1_TEMPLATE;
  226. typedef struct ASN1_TLC_st ASN1_TLC;
  227. /* This is just an opaque pointer */
  228. typedef struct ASN1_VALUE_st ASN1_VALUE;
  229. /* Declare ASN1 functions: the implement macro in in asn1t.h */
  230. #define DECLARE_ASN1_FUNCTIONS(type) DECLARE_ASN1_FUNCTIONS_name(type, type)
  231. #define DECLARE_ASN1_ALLOC_FUNCTIONS(type) \
  232. DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, type)
  233. #define DECLARE_ASN1_FUNCTIONS_name(type, name) \
  234. DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
  235. DECLARE_ASN1_ENCODE_FUNCTIONS(type, name, name)
  236. #define DECLARE_ASN1_FUNCTIONS_fname(type, itname, name) \
  237. DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
  238. DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name)
  239. #define DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) \
  240. OPENSSL_EXPORT type *d2i_##name(type **a, const unsigned char **in, long len); \
  241. OPENSSL_EXPORT int i2d_##name(type *a, unsigned char **out); \
  242. DECLARE_ASN1_ITEM(itname)
  243. #define DECLARE_ASN1_ENCODE_FUNCTIONS_const(type, name) \
  244. OPENSSL_EXPORT type *d2i_##name(type **a, const unsigned char **in, long len); \
  245. OPENSSL_EXPORT int i2d_##name(const type *a, unsigned char **out); \
  246. DECLARE_ASN1_ITEM(name)
  247. #define DECLARE_ASN1_NDEF_FUNCTION(name) \
  248. OPENSSL_EXPORT int i2d_##name##_NDEF(name *a, unsigned char **out);
  249. #define DECLARE_ASN1_FUNCTIONS_const(name) \
  250. DECLARE_ASN1_ALLOC_FUNCTIONS(name) \
  251. DECLARE_ASN1_ENCODE_FUNCTIONS_const(name, name)
  252. #define DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
  253. OPENSSL_EXPORT type *name##_new(void); \
  254. OPENSSL_EXPORT void name##_free(type *a);
  255. #define DECLARE_ASN1_PRINT_FUNCTION(stname) \
  256. DECLARE_ASN1_PRINT_FUNCTION_fname(stname, stname)
  257. #define DECLARE_ASN1_PRINT_FUNCTION_fname(stname, fname) \
  258. OPENSSL_EXPORT int fname##_print_ctx(BIO *out, stname *x, int indent, \
  259. const ASN1_PCTX *pctx);
  260. typedef void *d2i_of_void(void **, const unsigned char **, long);
  261. typedef int i2d_of_void(const void *, unsigned char **);
  262. /* The following macros and typedefs allow an ASN1_ITEM
  263. * to be embedded in a structure and referenced. Since
  264. * the ASN1_ITEM pointers need to be globally accessible
  265. * (possibly from shared libraries) they may exist in
  266. * different forms. On platforms that support it the
  267. * ASN1_ITEM structure itself will be globally exported.
  268. * Other platforms will export a function that returns
  269. * an ASN1_ITEM pointer.
  270. *
  271. * To handle both cases transparently the macros below
  272. * should be used instead of hard coding an ASN1_ITEM
  273. * pointer in a structure.
  274. *
  275. * The structure will look like this:
  276. *
  277. * typedef struct SOMETHING_st {
  278. * ...
  279. * ASN1_ITEM_EXP *iptr;
  280. * ...
  281. * } SOMETHING;
  282. *
  283. * It would be initialised as e.g.:
  284. *
  285. * SOMETHING somevar = {...,ASN1_ITEM_ref(X509),...};
  286. *
  287. * and the actual pointer extracted with:
  288. *
  289. * const ASN1_ITEM *it = ASN1_ITEM_ptr(somevar.iptr);
  290. *
  291. * Finally an ASN1_ITEM pointer can be extracted from an
  292. * appropriate reference with: ASN1_ITEM_rptr(X509). This
  293. * would be used when a function takes an ASN1_ITEM * argument.
  294. *
  295. */
  296. /* ASN1_ITEM pointer exported type */
  297. typedef const ASN1_ITEM ASN1_ITEM_EXP;
  298. /* Macro to obtain ASN1_ITEM pointer from exported type */
  299. #define ASN1_ITEM_ptr(iptr) (iptr)
  300. /* Macro to include ASN1_ITEM pointer from base type */
  301. #define ASN1_ITEM_ref(iptr) (&(iptr##_it))
  302. #define ASN1_ITEM_rptr(ref) (&(ref##_it))
  303. #define DECLARE_ASN1_ITEM(name) \
  304. extern OPENSSL_EXPORT const ASN1_ITEM name##_it;
  305. /* Parameters used by ASN1_STRING_print_ex() */
  306. /* These determine which characters to escape:
  307. * RFC2253 special characters, control characters and
  308. * MSB set characters
  309. */
  310. #define ASN1_STRFLGS_ESC_2253 1
  311. #define ASN1_STRFLGS_ESC_CTRL 2
  312. #define ASN1_STRFLGS_ESC_MSB 4
  313. /* This flag determines how we do escaping: normally
  314. * RC2253 backslash only, set this to use backslash and
  315. * quote.
  316. */
  317. #define ASN1_STRFLGS_ESC_QUOTE 8
  318. /* These three flags are internal use only. */
  319. /* Character is a valid PrintableString character */
  320. #define CHARTYPE_PRINTABLESTRING 0x10
  321. /* Character needs escaping if it is the first character */
  322. #define CHARTYPE_FIRST_ESC_2253 0x20
  323. /* Character needs escaping if it is the last character */
  324. #define CHARTYPE_LAST_ESC_2253 0x40
  325. /* NB the internal flags are safely reused below by flags
  326. * handled at the top level.
  327. */
  328. /* If this is set we convert all character strings
  329. * to UTF8 first
  330. */
  331. #define ASN1_STRFLGS_UTF8_CONVERT 0x10
  332. /* If this is set we don't attempt to interpret content:
  333. * just assume all strings are 1 byte per character. This
  334. * will produce some pretty odd looking output!
  335. */
  336. #define ASN1_STRFLGS_IGNORE_TYPE 0x20
  337. /* If this is set we include the string type in the output */
  338. #define ASN1_STRFLGS_SHOW_TYPE 0x40
  339. /* This determines which strings to display and which to
  340. * 'dump' (hex dump of content octets or DER encoding). We can
  341. * only dump non character strings or everything. If we
  342. * don't dump 'unknown' they are interpreted as character
  343. * strings with 1 octet per character and are subject to
  344. * the usual escaping options.
  345. */
  346. #define ASN1_STRFLGS_DUMP_ALL 0x80
  347. #define ASN1_STRFLGS_DUMP_UNKNOWN 0x100
  348. /* These determine what 'dumping' does, we can dump the
  349. * content octets or the DER encoding: both use the
  350. * RFC2253 #XXXXX notation.
  351. */
  352. #define ASN1_STRFLGS_DUMP_DER 0x200
  353. /* All the string flags consistent with RFC2253,
  354. * escaping control characters isn't essential in
  355. * RFC2253 but it is advisable anyway.
  356. */
  357. #define ASN1_STRFLGS_RFC2253 (ASN1_STRFLGS_ESC_2253 | \
  358. ASN1_STRFLGS_ESC_CTRL | \
  359. ASN1_STRFLGS_ESC_MSB | \
  360. ASN1_STRFLGS_UTF8_CONVERT | \
  361. ASN1_STRFLGS_DUMP_UNKNOWN | \
  362. ASN1_STRFLGS_DUMP_DER)
  363. DEFINE_STACK_OF(ASN1_INTEGER)
  364. DECLARE_ASN1_SET_OF(ASN1_INTEGER)
  365. struct asn1_type_st
  366. {
  367. int type;
  368. union {
  369. char *ptr;
  370. ASN1_BOOLEAN boolean;
  371. ASN1_STRING * asn1_string;
  372. ASN1_OBJECT * object;
  373. ASN1_INTEGER * integer;
  374. ASN1_ENUMERATED * enumerated;
  375. ASN1_BIT_STRING * bit_string;
  376. ASN1_OCTET_STRING * octet_string;
  377. ASN1_PRINTABLESTRING * printablestring;
  378. ASN1_T61STRING * t61string;
  379. ASN1_IA5STRING * ia5string;
  380. ASN1_GENERALSTRING * generalstring;
  381. ASN1_BMPSTRING * bmpstring;
  382. ASN1_UNIVERSALSTRING * universalstring;
  383. ASN1_UTCTIME * utctime;
  384. ASN1_GENERALIZEDTIME * generalizedtime;
  385. ASN1_VISIBLESTRING * visiblestring;
  386. ASN1_UTF8STRING * utf8string;
  387. /* set and sequence are left complete and still
  388. * contain the set or sequence bytes */
  389. ASN1_STRING * set;
  390. ASN1_STRING * sequence;
  391. ASN1_VALUE * asn1_value;
  392. } value;
  393. };
  394. DEFINE_STACK_OF(ASN1_TYPE)
  395. DECLARE_ASN1_SET_OF(ASN1_TYPE)
  396. typedef STACK_OF(ASN1_TYPE) ASN1_SEQUENCE_ANY;
  397. DECLARE_ASN1_ENCODE_FUNCTIONS_const(ASN1_SEQUENCE_ANY, ASN1_SEQUENCE_ANY)
  398. DECLARE_ASN1_ENCODE_FUNCTIONS_const(ASN1_SEQUENCE_ANY, ASN1_SET_ANY)
  399. struct X509_algor_st
  400. {
  401. ASN1_OBJECT *algorithm;
  402. ASN1_TYPE *parameter;
  403. } /* X509_ALGOR */;
  404. DECLARE_ASN1_FUNCTIONS(X509_ALGOR)
  405. /* This is used to contain a list of bit names */
  406. typedef struct BIT_STRING_BITNAME_st {
  407. int bitnum;
  408. const char *lname;
  409. const char *sname;
  410. } BIT_STRING_BITNAME;
  411. #define M_ASN1_STRING_length(x) ((x)->length)
  412. #define M_ASN1_STRING_length_set(x, n) ((x)->length = (n))
  413. #define M_ASN1_STRING_type(x) ((x)->type)
  414. #define M_ASN1_STRING_data(x) ((x)->data)
  415. /* Macros for string operations */
  416. #define M_ASN1_BIT_STRING_new() (ASN1_BIT_STRING *)\
  417. ASN1_STRING_type_new(V_ASN1_BIT_STRING)
  418. #define M_ASN1_BIT_STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  419. #define M_ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
  420. ASN1_STRING_dup((const ASN1_STRING *)a)
  421. #define M_ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
  422. (const ASN1_STRING *)a,(const ASN1_STRING *)b)
  423. #define M_ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
  424. #define M_ASN1_INTEGER_new() (ASN1_INTEGER *)\
  425. ASN1_STRING_type_new(V_ASN1_INTEGER)
  426. #define M_ASN1_INTEGER_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  427. #define M_ASN1_INTEGER_dup(a) (ASN1_INTEGER *)\
  428. ASN1_STRING_dup((const ASN1_STRING *)a)
  429. #define M_ASN1_INTEGER_cmp(a,b) ASN1_STRING_cmp(\
  430. (const ASN1_STRING *)a,(const ASN1_STRING *)b)
  431. #define M_ASN1_ENUMERATED_new() (ASN1_ENUMERATED *)\
  432. ASN1_STRING_type_new(V_ASN1_ENUMERATED)
  433. #define M_ASN1_ENUMERATED_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  434. #define M_ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)\
  435. ASN1_STRING_dup((const ASN1_STRING *)a)
  436. #define M_ASN1_ENUMERATED_cmp(a,b) ASN1_STRING_cmp(\
  437. (const ASN1_STRING *)a,(const ASN1_STRING *)b)
  438. #define M_ASN1_OCTET_STRING_new() (ASN1_OCTET_STRING *)\
  439. ASN1_STRING_type_new(V_ASN1_OCTET_STRING)
  440. #define M_ASN1_OCTET_STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  441. #define M_ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
  442. ASN1_STRING_dup((const ASN1_STRING *)a)
  443. #define M_ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
  444. (const ASN1_STRING *)a,(const ASN1_STRING *)b)
  445. #define M_ASN1_OCTET_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
  446. #define M_ASN1_OCTET_STRING_print(a,b) ASN1_STRING_print(a,(ASN1_STRING *)b)
  447. #define B_ASN1_TIME \
  448. B_ASN1_UTCTIME | \
  449. B_ASN1_GENERALIZEDTIME
  450. #define B_ASN1_PRINTABLE \
  451. B_ASN1_NUMERICSTRING| \
  452. B_ASN1_PRINTABLESTRING| \
  453. B_ASN1_T61STRING| \
  454. B_ASN1_IA5STRING| \
  455. B_ASN1_BIT_STRING| \
  456. B_ASN1_UNIVERSALSTRING|\
  457. B_ASN1_BMPSTRING|\
  458. B_ASN1_UTF8STRING|\
  459. B_ASN1_SEQUENCE|\
  460. B_ASN1_UNKNOWN
  461. #define B_ASN1_DIRECTORYSTRING \
  462. B_ASN1_PRINTABLESTRING| \
  463. B_ASN1_TELETEXSTRING|\
  464. B_ASN1_BMPSTRING|\
  465. B_ASN1_UNIVERSALSTRING|\
  466. B_ASN1_UTF8STRING
  467. #define B_ASN1_DISPLAYTEXT \
  468. B_ASN1_IA5STRING| \
  469. B_ASN1_VISIBLESTRING| \
  470. B_ASN1_BMPSTRING|\
  471. B_ASN1_UTF8STRING
  472. #define M_ASN1_PRINTABLE_new() ASN1_STRING_type_new(V_ASN1_T61STRING)
  473. #define M_ASN1_PRINTABLE_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  474. #define M_DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
  475. #define M_DIRECTORYSTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  476. #define M_DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
  477. #define M_DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  478. #define M_ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
  479. ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
  480. #define M_ASN1_PRINTABLESTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  481. #define M_ASN1_T61STRING_new() (ASN1_T61STRING *)\
  482. ASN1_STRING_type_new(V_ASN1_T61STRING)
  483. #define M_ASN1_T61STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  484. #define M_ASN1_IA5STRING_new() (ASN1_IA5STRING *)\
  485. ASN1_STRING_type_new(V_ASN1_IA5STRING)
  486. #define M_ASN1_IA5STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  487. #define M_ASN1_IA5STRING_dup(a) \
  488. (ASN1_IA5STRING *)ASN1_STRING_dup((const ASN1_STRING *)a)
  489. #define M_ASN1_UTCTIME_new() (ASN1_UTCTIME *)\
  490. ASN1_STRING_type_new(V_ASN1_UTCTIME)
  491. #define M_ASN1_UTCTIME_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  492. #define M_ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)\
  493. ASN1_STRING_dup((const ASN1_STRING *)a)
  494. #define M_ASN1_GENERALIZEDTIME_new() (ASN1_GENERALIZEDTIME *)\
  495. ASN1_STRING_type_new(V_ASN1_GENERALIZEDTIME)
  496. #define M_ASN1_GENERALIZEDTIME_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  497. #define M_ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
  498. (const ASN1_STRING *)a)
  499. #define M_ASN1_TIME_new() (ASN1_TIME *)\
  500. ASN1_STRING_type_new(V_ASN1_UTCTIME)
  501. #define M_ASN1_TIME_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  502. #define M_ASN1_TIME_dup(a) (ASN1_TIME *)\
  503. ASN1_STRING_dup((const ASN1_STRING *)a)
  504. #define M_ASN1_GENERALSTRING_new() (ASN1_GENERALSTRING *)\
  505. ASN1_STRING_type_new(V_ASN1_GENERALSTRING)
  506. #define M_ASN1_GENERALSTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  507. #define M_ASN1_UNIVERSALSTRING_new() (ASN1_UNIVERSALSTRING *)\
  508. ASN1_STRING_type_new(V_ASN1_UNIVERSALSTRING)
  509. #define M_ASN1_UNIVERSALSTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  510. #define M_ASN1_BMPSTRING_new() (ASN1_BMPSTRING *)\
  511. ASN1_STRING_type_new(V_ASN1_BMPSTRING)
  512. #define M_ASN1_BMPSTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  513. #define M_ASN1_VISIBLESTRING_new() (ASN1_VISIBLESTRING *)\
  514. ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
  515. #define M_ASN1_VISIBLESTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  516. #define M_ASN1_UTF8STRING_new() (ASN1_UTF8STRING *)\
  517. ASN1_STRING_type_new(V_ASN1_UTF8STRING)
  518. #define M_ASN1_UTF8STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
  519. DECLARE_ASN1_FUNCTIONS_fname(ASN1_TYPE, ASN1_ANY, ASN1_TYPE)
  520. OPENSSL_EXPORT int ASN1_TYPE_get(ASN1_TYPE *a);
  521. OPENSSL_EXPORT void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
  522. OPENSSL_EXPORT int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value);
  523. OPENSSL_EXPORT int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b);
  524. OPENSSL_EXPORT ASN1_OBJECT * ASN1_OBJECT_new(void );
  525. OPENSSL_EXPORT void ASN1_OBJECT_free(ASN1_OBJECT *a);
  526. OPENSSL_EXPORT int i2d_ASN1_OBJECT(ASN1_OBJECT *a,unsigned char **pp);
  527. OPENSSL_EXPORT ASN1_OBJECT * c2i_ASN1_OBJECT(ASN1_OBJECT **a,const unsigned char **pp,
  528. long length);
  529. OPENSSL_EXPORT ASN1_OBJECT * d2i_ASN1_OBJECT(ASN1_OBJECT **a,const unsigned char **pp,
  530. long length);
  531. DECLARE_ASN1_ITEM(ASN1_OBJECT)
  532. DECLARE_ASN1_SET_OF(ASN1_OBJECT)
  533. OPENSSL_EXPORT ASN1_STRING * ASN1_STRING_new(void);
  534. OPENSSL_EXPORT void ASN1_STRING_free(ASN1_STRING *a);
  535. OPENSSL_EXPORT int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str);
  536. OPENSSL_EXPORT ASN1_STRING * ASN1_STRING_dup(const ASN1_STRING *a);
  537. OPENSSL_EXPORT ASN1_STRING * ASN1_STRING_type_new(int type );
  538. OPENSSL_EXPORT int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b);
  539. /* Since this is used to store all sorts of things, via macros, for now, make
  540. its data void * */
  541. OPENSSL_EXPORT int ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
  542. OPENSSL_EXPORT void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len);
  543. OPENSSL_EXPORT int ASN1_STRING_length(const ASN1_STRING *x);
  544. OPENSSL_EXPORT void ASN1_STRING_length_set(ASN1_STRING *x, int n);
  545. OPENSSL_EXPORT int ASN1_STRING_type(ASN1_STRING *x);
  546. OPENSSL_EXPORT unsigned char * ASN1_STRING_data(ASN1_STRING *x);
  547. OPENSSL_EXPORT const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x);
  548. DECLARE_ASN1_FUNCTIONS(ASN1_BIT_STRING)
  549. OPENSSL_EXPORT int i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a,unsigned char **pp);
  550. OPENSSL_EXPORT ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,const unsigned char **pp, long length);
  551. OPENSSL_EXPORT int ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d, int length );
  552. OPENSSL_EXPORT int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
  553. OPENSSL_EXPORT int ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n);
  554. OPENSSL_EXPORT int ASN1_BIT_STRING_check(ASN1_BIT_STRING *a, unsigned char *flags, int flags_len);
  555. OPENSSL_EXPORT int i2d_ASN1_BOOLEAN(int a,unsigned char **pp);
  556. OPENSSL_EXPORT int d2i_ASN1_BOOLEAN(int *a,const unsigned char **pp,long length);
  557. DECLARE_ASN1_FUNCTIONS(ASN1_INTEGER)
  558. OPENSSL_EXPORT int i2c_ASN1_INTEGER(ASN1_INTEGER *a,unsigned char **pp);
  559. OPENSSL_EXPORT ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a,const unsigned char **pp, long length);
  560. OPENSSL_EXPORT ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a,const unsigned char **pp, long length);
  561. OPENSSL_EXPORT ASN1_INTEGER * ASN1_INTEGER_dup(const ASN1_INTEGER *x);
  562. OPENSSL_EXPORT int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y);
  563. DECLARE_ASN1_FUNCTIONS(ASN1_ENUMERATED)
  564. OPENSSL_EXPORT int ASN1_UTCTIME_check(const ASN1_UTCTIME *a);
  565. OPENSSL_EXPORT ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s,time_t t);
  566. OPENSSL_EXPORT ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t, int offset_day, long offset_sec);
  567. OPENSSL_EXPORT int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str);
  568. OPENSSL_EXPORT int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t);
  569. #if 0
  570. time_t ASN1_UTCTIME_get(const ASN1_UTCTIME *s);
  571. #endif
  572. OPENSSL_EXPORT int ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *a);
  573. OPENSSL_EXPORT ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,time_t t);
  574. OPENSSL_EXPORT ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s, time_t t, int offset_day, long offset_sec);
  575. OPENSSL_EXPORT int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str);
  576. OPENSSL_EXPORT int ASN1_TIME_diff(int *pday, int *psec, const ASN1_TIME *from, const ASN1_TIME *to);
  577. DECLARE_ASN1_FUNCTIONS(ASN1_OCTET_STRING)
  578. OPENSSL_EXPORT ASN1_OCTET_STRING * ASN1_OCTET_STRING_dup(const ASN1_OCTET_STRING *a);
  579. OPENSSL_EXPORT int ASN1_OCTET_STRING_cmp(const ASN1_OCTET_STRING *a, const ASN1_OCTET_STRING *b);
  580. OPENSSL_EXPORT int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, const unsigned char *data, int len);
  581. DECLARE_ASN1_FUNCTIONS(ASN1_VISIBLESTRING)
  582. DECLARE_ASN1_FUNCTIONS(ASN1_UNIVERSALSTRING)
  583. DECLARE_ASN1_FUNCTIONS(ASN1_UTF8STRING)
  584. DECLARE_ASN1_FUNCTIONS(ASN1_NULL)
  585. DECLARE_ASN1_FUNCTIONS(ASN1_BMPSTRING)
  586. DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, ASN1_PRINTABLE)
  587. DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, DIRECTORYSTRING)
  588. DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, DISPLAYTEXT)
  589. DECLARE_ASN1_FUNCTIONS(ASN1_PRINTABLESTRING)
  590. DECLARE_ASN1_FUNCTIONS(ASN1_T61STRING)
  591. DECLARE_ASN1_FUNCTIONS(ASN1_IA5STRING)
  592. DECLARE_ASN1_FUNCTIONS(ASN1_GENERALSTRING)
  593. DECLARE_ASN1_FUNCTIONS(ASN1_UTCTIME)
  594. DECLARE_ASN1_FUNCTIONS(ASN1_GENERALIZEDTIME)
  595. DECLARE_ASN1_FUNCTIONS(ASN1_TIME)
  596. DECLARE_ASN1_ITEM(ASN1_OCTET_STRING_NDEF)
  597. OPENSSL_EXPORT ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s,time_t t);
  598. OPENSSL_EXPORT ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s,time_t t, int offset_day, long offset_sec);
  599. OPENSSL_EXPORT int ASN1_TIME_check(ASN1_TIME *t);
  600. OPENSSL_EXPORT ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t, ASN1_GENERALIZEDTIME **out);
  601. OPENSSL_EXPORT int ASN1_TIME_set_string(ASN1_TIME *s, const char *str);
  602. OPENSSL_EXPORT int i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a);
  603. OPENSSL_EXPORT int i2a_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *a);
  604. OPENSSL_EXPORT int i2a_ASN1_OBJECT(BIO *bp,ASN1_OBJECT *a);
  605. OPENSSL_EXPORT int i2a_ASN1_STRING(BIO *bp, ASN1_STRING *a, int type);
  606. OPENSSL_EXPORT int i2t_ASN1_OBJECT(char *buf,int buf_len,ASN1_OBJECT *a);
  607. OPENSSL_EXPORT ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data,int len, const char *sn, const char *ln);
  608. OPENSSL_EXPORT int ASN1_INTEGER_set(ASN1_INTEGER *a, long v);
  609. OPENSSL_EXPORT int ASN1_INTEGER_set_uint64(ASN1_INTEGER *out, uint64_t v);
  610. OPENSSL_EXPORT long ASN1_INTEGER_get(const ASN1_INTEGER *a);
  611. OPENSSL_EXPORT ASN1_INTEGER *BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai);
  612. OPENSSL_EXPORT BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai,BIGNUM *bn);
  613. OPENSSL_EXPORT int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v);
  614. OPENSSL_EXPORT long ASN1_ENUMERATED_get(ASN1_ENUMERATED *a);
  615. OPENSSL_EXPORT ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai);
  616. OPENSSL_EXPORT BIGNUM *ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai,BIGNUM *bn);
  617. /* General */
  618. /* given a string, return the correct type, max is the maximum length */
  619. OPENSSL_EXPORT int ASN1_PRINTABLE_type(const unsigned char *s, int max);
  620. OPENSSL_EXPORT unsigned long ASN1_tag2bit(int tag);
  621. /* SPECIALS */
  622. OPENSSL_EXPORT int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag, int *pclass, long omax);
  623. OPENSSL_EXPORT void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag, int xclass);
  624. OPENSSL_EXPORT int ASN1_put_eoc(unsigned char **pp);
  625. OPENSSL_EXPORT int ASN1_object_size(int constructed, int length, int tag);
  626. OPENSSL_EXPORT void *ASN1_item_dup(const ASN1_ITEM *it, void *x);
  627. #ifndef OPENSSL_NO_FP_API
  628. OPENSSL_EXPORT void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x);
  629. OPENSSL_EXPORT int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x);
  630. OPENSSL_EXPORT int ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags);
  631. #endif
  632. OPENSSL_EXPORT int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in);
  633. OPENSSL_EXPORT void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x);
  634. OPENSSL_EXPORT int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x);
  635. OPENSSL_EXPORT int ASN1_UTCTIME_print(BIO *fp, const ASN1_UTCTIME *a);
  636. OPENSSL_EXPORT int ASN1_GENERALIZEDTIME_print(BIO *fp, const ASN1_GENERALIZEDTIME *a);
  637. OPENSSL_EXPORT int ASN1_TIME_print(BIO *fp, const ASN1_TIME *a);
  638. OPENSSL_EXPORT int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v);
  639. OPENSSL_EXPORT int ASN1_STRING_print_ex(BIO *out, ASN1_STRING *str, unsigned long flags);
  640. OPENSSL_EXPORT const char *ASN1_tag2str(int tag);
  641. /* Used to load and write netscape format cert */
  642. OPENSSL_EXPORT void *ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it);
  643. OPENSSL_EXPORT ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_OCTET_STRING **oct);
  644. OPENSSL_EXPORT void ASN1_STRING_set_default_mask(unsigned long mask);
  645. OPENSSL_EXPORT int ASN1_STRING_set_default_mask_asc(const char *p);
  646. OPENSSL_EXPORT unsigned long ASN1_STRING_get_default_mask(void);
  647. OPENSSL_EXPORT int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len, int inform, unsigned long mask);
  648. OPENSSL_EXPORT int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len, int inform, unsigned long mask, long minsize, long maxsize);
  649. OPENSSL_EXPORT ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, const unsigned char *in, int inlen, int inform, int nid);
  650. OPENSSL_EXPORT ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid);
  651. OPENSSL_EXPORT int ASN1_STRING_TABLE_add(int, long, long, unsigned long, unsigned long);
  652. OPENSSL_EXPORT void ASN1_STRING_TABLE_cleanup(void);
  653. /* ASN1 template functions */
  654. /* Old API compatible functions */
  655. OPENSSL_EXPORT ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it);
  656. OPENSSL_EXPORT void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it);
  657. OPENSSL_EXPORT ASN1_VALUE * ASN1_item_d2i(ASN1_VALUE **val, const unsigned char **in, long len, const ASN1_ITEM *it);
  658. OPENSSL_EXPORT int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
  659. OPENSSL_EXPORT int ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
  660. OPENSSL_EXPORT ASN1_TYPE *ASN1_generate_nconf(char *str, CONF *nconf);
  661. OPENSSL_EXPORT ASN1_TYPE *ASN1_generate_v3(char *str, X509V3_CTX *cnf);
  662. #ifdef __cplusplus
  663. }
  664. extern "C++" {
  665. BSSL_NAMESPACE_BEGIN
  666. BORINGSSL_MAKE_DELETER(ASN1_OBJECT, ASN1_OBJECT_free)
  667. BORINGSSL_MAKE_DELETER(ASN1_STRING, ASN1_STRING_free)
  668. BORINGSSL_MAKE_DELETER(ASN1_TYPE, ASN1_TYPE_free)
  669. BSSL_NAMESPACE_END
  670. } /* extern C++ */
  671. #endif
  672. #define ASN1_R_ASN1_LENGTH_MISMATCH 100
  673. #define ASN1_R_AUX_ERROR 101
  674. #define ASN1_R_BAD_GET_ASN1_OBJECT_CALL 102
  675. #define ASN1_R_BAD_OBJECT_HEADER 103
  676. #define ASN1_R_BMPSTRING_IS_WRONG_LENGTH 104
  677. #define ASN1_R_BN_LIB 105
  678. #define ASN1_R_BOOLEAN_IS_WRONG_LENGTH 106
  679. #define ASN1_R_BUFFER_TOO_SMALL 107
  680. #define ASN1_R_CONTEXT_NOT_INITIALISED 108
  681. #define ASN1_R_DECODE_ERROR 109
  682. #define ASN1_R_DEPTH_EXCEEDED 110
  683. #define ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED 111
  684. #define ASN1_R_ENCODE_ERROR 112
  685. #define ASN1_R_ERROR_GETTING_TIME 113
  686. #define ASN1_R_EXPECTING_AN_ASN1_SEQUENCE 114
  687. #define ASN1_R_EXPECTING_AN_INTEGER 115
  688. #define ASN1_R_EXPECTING_AN_OBJECT 116
  689. #define ASN1_R_EXPECTING_A_BOOLEAN 117
  690. #define ASN1_R_EXPECTING_A_TIME 118
  691. #define ASN1_R_EXPLICIT_LENGTH_MISMATCH 119
  692. #define ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED 120
  693. #define ASN1_R_FIELD_MISSING 121
  694. #define ASN1_R_FIRST_NUM_TOO_LARGE 122
  695. #define ASN1_R_HEADER_TOO_LONG 123
  696. #define ASN1_R_ILLEGAL_BITSTRING_FORMAT 124
  697. #define ASN1_R_ILLEGAL_BOOLEAN 125
  698. #define ASN1_R_ILLEGAL_CHARACTERS 126
  699. #define ASN1_R_ILLEGAL_FORMAT 127
  700. #define ASN1_R_ILLEGAL_HEX 128
  701. #define ASN1_R_ILLEGAL_IMPLICIT_TAG 129
  702. #define ASN1_R_ILLEGAL_INTEGER 130
  703. #define ASN1_R_ILLEGAL_NESTED_TAGGING 131
  704. #define ASN1_R_ILLEGAL_NULL 132
  705. #define ASN1_R_ILLEGAL_NULL_VALUE 133
  706. #define ASN1_R_ILLEGAL_OBJECT 134
  707. #define ASN1_R_ILLEGAL_OPTIONAL_ANY 135
  708. #define ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE 136
  709. #define ASN1_R_ILLEGAL_TAGGED_ANY 137
  710. #define ASN1_R_ILLEGAL_TIME_VALUE 138
  711. #define ASN1_R_INTEGER_NOT_ASCII_FORMAT 139
  712. #define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG 140
  713. #define ASN1_R_INVALID_BIT_STRING_BITS_LEFT 141
  714. #define ASN1_R_INVALID_BMPSTRING 142
  715. #define ASN1_R_INVALID_DIGIT 143
  716. #define ASN1_R_INVALID_MODIFIER 144
  717. #define ASN1_R_INVALID_NUMBER 145
  718. #define ASN1_R_INVALID_OBJECT_ENCODING 146
  719. #define ASN1_R_INVALID_SEPARATOR 147
  720. #define ASN1_R_INVALID_TIME_FORMAT 148
  721. #define ASN1_R_INVALID_UNIVERSALSTRING 149
  722. #define ASN1_R_INVALID_UTF8STRING 150
  723. #define ASN1_R_LIST_ERROR 151
  724. #define ASN1_R_MISSING_ASN1_EOS 152
  725. #define ASN1_R_MISSING_EOC 153
  726. #define ASN1_R_MISSING_SECOND_NUMBER 154
  727. #define ASN1_R_MISSING_VALUE 155
  728. #define ASN1_R_MSTRING_NOT_UNIVERSAL 156
  729. #define ASN1_R_MSTRING_WRONG_TAG 157
  730. #define ASN1_R_NESTED_ASN1_ERROR 158
  731. #define ASN1_R_NESTED_ASN1_STRING 159
  732. #define ASN1_R_NON_HEX_CHARACTERS 160
  733. #define ASN1_R_NOT_ASCII_FORMAT 161
  734. #define ASN1_R_NOT_ENOUGH_DATA 162
  735. #define ASN1_R_NO_MATCHING_CHOICE_TYPE 163
  736. #define ASN1_R_NULL_IS_WRONG_LENGTH 164
  737. #define ASN1_R_OBJECT_NOT_ASCII_FORMAT 165
  738. #define ASN1_R_ODD_NUMBER_OF_CHARS 166
  739. #define ASN1_R_SECOND_NUMBER_TOO_LARGE 167
  740. #define ASN1_R_SEQUENCE_LENGTH_MISMATCH 168
  741. #define ASN1_R_SEQUENCE_NOT_CONSTRUCTED 169
  742. #define ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG 170
  743. #define ASN1_R_SHORT_LINE 171
  744. #define ASN1_R_STREAMING_NOT_SUPPORTED 172
  745. #define ASN1_R_STRING_TOO_LONG 173
  746. #define ASN1_R_STRING_TOO_SHORT 174
  747. #define ASN1_R_TAG_VALUE_TOO_HIGH 175
  748. #define ASN1_R_TIME_NOT_ASCII_FORMAT 176
  749. #define ASN1_R_TOO_LONG 177
  750. #define ASN1_R_TYPE_NOT_CONSTRUCTED 178
  751. #define ASN1_R_TYPE_NOT_PRIMITIVE 179
  752. #define ASN1_R_UNEXPECTED_EOC 180
  753. #define ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH 181
  754. #define ASN1_R_UNKNOWN_FORMAT 182
  755. #define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM 183
  756. #define ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM 184
  757. #define ASN1_R_UNKNOWN_TAG 185
  758. #define ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE 186
  759. #define ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE 187
  760. #define ASN1_R_UNSUPPORTED_TYPE 188
  761. #define ASN1_R_WRONG_PUBLIC_KEY_TYPE 189
  762. #define ASN1_R_WRONG_TAG 190
  763. #define ASN1_R_WRONG_TYPE 191
  764. #define ASN1_R_NESTED_TOO_DEEP 192
  765. #endif